#!/bin/bash
set -euo pipefail
source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
ensure_prerequisites
load_secrets_to_ram

log_info "[Layer 2: Tier-0 Air-Gap] Развертывание базовой инфраструктуры (Registry, DNS, Vault)..."
for pb in 03_reg.yml 04_dns.yml 05_vault.yml; do
    ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}"
done

log_info "[Layer 2: Tier-0 Air-Gap] Распечатывание OpenBao Vault..."
unseal_vault

log_info "[Layer 2: Tier-0 Air-Gap] Наполнение Vault секретами через OpenTofu..."
cd "${REPO_ROOT}/tofu" && tofu apply -auto-approve

log_info "[Layer 2: Tier-0 Air-Gap] Развертывание зависимых сервисов (Forgejo, NAS Storage)..."
for pb in 06_git.yml 07_nas.yml; do
    ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}"
done

log_info "[Layer 2: Tier-0 Air-Gap] Автоматическая первичная синхронизация Git в Forgejo (SEC-03 RAM auth)..."
CURRENT_BRANCH=$(git -C "${REPO_ROOT}" branch --show-current 2>/dev/null || echo "master")
git -C "${REPO_ROOT}" push -u http://10.0.10.13:3000/atlas/atlas.git "${CURRENT_BRANCH}" 2>/dev/null || \
    git -C "${REPO_ROOT}" push http://10.0.10.13:3000/atlas/atlas.git "${CURRENT_BRANCH}" 2>/dev/null || true

log_ok "Layer 2 готов. Базовые сервисы, секреты и GitOps-репозиторий развернуты."